{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-06-19T00:00:00", "descriptions": [{"lang": "en", "value": "choose_file.php in easy-CMS 0.1.2, when mod_mime is installed, does not restrict uploads of filenames with multiple extensions, which allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a GIF file extension, then directly accessing that file in the Repositories directory."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-18T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20733", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/20733"}, {"name": "20060618 Easy CMS 0.1.2 Php Shell Upload Vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/437705/100/0/threaded"}, {"name": "1016335", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1016335"}, {"name": "ADV-2006-2419", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2006/2419"}, {"tags": ["x_refsource_MISC"], "url": "http://biyosecurity.be/bugs/easycms.txt"}, {"name": "18496", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/18496"}, {"name": "26633", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/26633"}, {"name": "easycms-extensions-file-upload(27281)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27281"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-3128", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "choose_file.php in easy-CMS 0.1.2, when mod_mime is installed, does not restrict uploads of filenames with multiple extensions, which allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a GIF file extension, then directly accessing that file in the Repositories directory."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20733", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/20733"}, {"name": "20060618 Easy CMS 0.1.2 Php Shell Upload Vulnerabilities", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/437705/100/0/threaded"}, {"name": "1016335", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1016335"}, {"name": "ADV-2006-2419", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2006/2419"}, {"name": "http://biyosecurity.be/bugs/easycms.txt", "refsource": "MISC", "url": "http://biyosecurity.be/bugs/easycms.txt"}, {"name": "18496", "refsource": "BID", "url": "http://www.securityfocus.com/bid/18496"}, {"name": "26633", "refsource": "OSVDB", "url": "http://www.osvdb.org/26633"}, {"name": "easycms-extensions-file-upload(27281)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27281"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T18:16:05.825Z"}, "title": "CVE Program Container", "references": [{"name": "20733", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/20733"}, {"name": "20060618 Easy CMS 0.1.2 Php Shell Upload Vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/437705/100/0/threaded"}, {"name": "1016335", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1016335"}, {"name": "ADV-2006-2419", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2006/2419"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://biyosecurity.be/bugs/easycms.txt"}, {"name": "18496", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/18496"}, {"name": "26633", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/26633"}, {"name": "easycms-extensions-file-upload(27281)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27281"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-3128", "datePublished": "2006-06-21T23:00:00", "dateReserved": "2006-06-21T00:00:00", "dateUpdated": "2024-08-07T18:16:05.825Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:easy-cms:easy-cms:0.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "A768EBF2-C137-4E87-8790-3B4FEBE2D73E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "choose_file.php in easy-CMS 0.1.2, when mod_mime is installed, does not restrict uploads of filenames with multiple extensions, which allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a GIF file extension, then directly accessing that file in the Repositories directory."}, {"lang": "es", "value": "choose_file.php en easy-CMS v0.1.2, cuando mod_mime es instalado, no restringe subida de ficheros con m\u00faltiples extensiones, lo que permite que atacantes remotos ejecuten c\u00f3digo PHP de su elecci\u00f3n actualizando un fichero PHP con una extensi\u00f3n GIF, despu\u00e9s accediendo directamente al fichero en el directorio Repositories."}], "id": "CVE-2006-3128", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2006-06-21T23:02:00.000", "references": [{"source": "cve@mitre.org", "url": "http://biyosecurity.be/bugs/easycms.txt"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/20733"}, {"source": "cve@mitre.org", "url": "http://securitytracker.com/id?1016335"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/26633"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/437705/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/18496"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2006/2419"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27281"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://biyosecurity.be/bugs/easycms.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/20733"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securitytracker.com/id?1016335"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/26633"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/437705/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/18496"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2006/2419"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27281"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}